CVE-2025-43596 HIGH

CVE-2025-43596: MSP360 Backup (for Windows) insecure filesystem permissions

Vendor Msp360
Product Backup
Weakness CWE-276
Published May 22, 2025
Last update May 22, 2025
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).

Key dates

02Disclosure timeline

May 22, 2025 CVE published
May 22, 2025 Record updated